diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index 36cf06b..c8ecad8 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -32,6 +32,10 @@ jobs:
 
       - name: Setup helm
         uses: azure/setup-helm@v5
+        with:
+          version: latest
+          # fail instead of silently falling back to Helm v3, which lacks --wait=watcher
+          latest-fallback: "false"
 
       - name: Setup kind
         uses: helm/kind-action@v1
diff --git a/README.md b/README.md
index d84154b..b0b1518 100644
--- a/README.md
+++ b/README.md
@@ -122,6 +122,31 @@ When `validate_key` is enabled, the operator verifies at startup that the config
 
 Supported providers: `aws` (KMS), `azure` (Key Vault), `gcp` (Cloud KMS), `vault` (Transit Engine), `file` (embedded)
 
+**Behind a TLS-inspecting proxy:**
+
+To trust additional CAs (e.g. a firewall's inspection CA) *on top of* the system roots, mount them as PEM files and add the directory to `SSL_CERT_DIR` (don't use `SSL_CERT_FILE`, which replaces the system bundle). Proxy settings (`HTTPS_PROXY`/`NO_PROXY`) are honoured too.
+
+`SSL_CERT_DIR` replaces Go's default CA *directory* list (`/etc/ssl/certs`, `/etc/pki/tls/certs`) but not its bundle-file lookup, so list the defaults explicitly: this keeps system trust intact whichever layout the image uses, including custom builds.
+
+```yaml
+# Helm values
+manager:
+  env:
+    - name: SSL_CERT_DIR
+      value: /etc/ssl/certs:/etc/pki/tls/certs:/etc/ssl/extra-ca
+  extraVolumes:
+    - name: extra-ca
+      configMap:
+        name: corp-ca # ConfigMap whose keys are PEM-encoded CA certificates
+        optional: true # if absent, the directory is empty and only the system CAs are trusted
+  extraVolumeMounts:
+    - name: extra-ca
+      mountPath: /etc/ssl/extra-ca
+      readOnly: true
+```
+
+CAs are loaded once at startup; restart the pod after creating or rotating the ConfigMap.
+
 ### Token Resources
 
 Create `Token` (namespaced) or `ClusterToken` (cluster-scoped) resources to generate secure `Secret` objects:
diff --git a/deploy/charts/github-token-manager/Chart.yaml b/deploy/charts/github-token-manager/Chart.yaml
index 06a6a33..c882374 100644
--- a/deploy/charts/github-token-manager/Chart.yaml
+++ b/deploy/charts/github-token-manager/Chart.yaml
@@ -4,4 +4,4 @@ name: github-token-manager
 description: A Helm chart for github-token-manager
 
 type: application
-version: 0.4.0
+version: 0.5.0
diff --git a/deploy/charts/github-token-manager/templates/deployment.yaml b/deploy/charts/github-token-manager/templates/deployment.yaml
index 680d73e..055d5d2 100644
--- a/deploy/charts/github-token-manager/templates/deployment.yaml
+++ b/deploy/charts/github-token-manager/templates/deployment.yaml
@@ -93,6 +93,9 @@ spec:
             - mountPath: /config
               name: config
               readOnly: true
+            {{- with $manager.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
       {{- with $manager.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -113,3 +116,6 @@ spec:
             defaultMode: 444
             optional: true
             secretName: {{ .Values.config.secretName }}
+        {{- with $manager.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
diff --git a/deploy/charts/github-token-manager/values.yaml b/deploy/charts/github-token-manager/values.yaml
index e012fdb..362dcb4 100644
--- a/deploy/charts/github-token-manager/values.yaml
+++ b/deploy/charts/github-token-manager/values.yaml
@@ -65,6 +65,8 @@ metrics:
 ##   tolerations: list of tolerations (optional)
 ##   nodeSelector: node selector (optional)
 ##   env: list of additional environment variables to set on the manager container
+##   extraVolumes: list of additional pod volumes (optional)
+##   extraVolumeMounts: list of additional manager container volume mounts (optional)
 ##   resources: manager container resource requests and limits
 ## manager
 ##   repository: image repository
@@ -81,6 +83,10 @@ manager:
   # additional environment variables to set on the controller container
   # e.g. `[{name: VAULT_ADDR, value: http://vault:8200}]`
   env: []
+  # additional volumes and mounts for the manager pod/container, e.g. to extend
+  # the trusted CAs: set env SSL_CERT_DIR to the mountPath of a ConfigMap of PEMs
+  extraVolumes: []
+  extraVolumeMounts: []
   extraArgs: {}
   resources:
     limits: